Fix: unchecked buffer size for communication header

[lttng-tools.git] / src / common / actions / action.c

diff --git a/src/common/actions/action.c b/src/common/actions/action.c
index a0347a34c66ee53abd7b1851bdc362b3fffe2c78..95a0c0f4d20a19eb743b60d392c65934a82d656f 100644 (file)
--- a/src/common/actions/action.c
+++ b/src/common/actions/action.c
@@ -15,7 +15,8 @@
 #include <lttng/action/start-session-internal.h>
 #include <lttng/action/stop-session-internal.h>
 
-static const char *lttng_action_type_string(enum lttng_action_type action_type)
+LTTNG_HIDDEN
+const char *lttng_action_type_string(enum lttng_action_type action_type)
 {
        switch (action_type) {
        case LTTNG_ACTION_TYPE_UNKNOWN:
@@ -37,18 +38,11 @@ static const char *lttng_action_type_string(enum lttng_action_type action_type)
        }
 }
 
-enum lttng_action_type lttng_action_get_type(struct lttng_action *action)
+enum lttng_action_type lttng_action_get_type(const struct lttng_action *action)
 {
        return action ? action->type : LTTNG_ACTION_TYPE_UNKNOWN;
 }
 
-LTTNG_HIDDEN
-enum lttng_action_type lttng_action_get_type_const(
-               const struct lttng_action *action)
-{
-       return action->type;
-}
-
 LTTNG_HIDDEN
 void lttng_action_init(
                struct lttng_action *action,
@@ -146,15 +140,24 @@ ssize_t lttng_action_create_from_payload(struct lttng_payload_view *view,
                struct lttng_action **action)
 {
        ssize_t consumed_len, specific_action_consumed_len;
-       const struct lttng_action_comm *action_comm;
        action_create_from_payload_cb create_from_payload_cb;
+       const struct lttng_action_comm *action_comm;
+       const struct lttng_payload_view action_comm_view =
+                       lttng_payload_view_from_view(
+                                       view, 0, sizeof(*action_comm));
 
        if (!view || !action) {
                consumed_len = -1;
                goto end;
        }
 
-       action_comm = (const struct lttng_action_comm *) view->buffer.data;
+       if (!lttng_payload_view_is_valid(&action_comm_view)) {
+               /* Payload not large enough to contain the header. */
+               consumed_len = -1;
+               goto end;
+       }
+
+       action_comm = (const struct lttng_action_comm *) action_comm_view.buffer.data;
 
        DBG("Create action from payload: action-type=%s",
                        lttng_action_type_string(action_comm->action_type));